Countersigning an intra-group outsourcing deal while the compliance officer reports to the CEO
The compliance officer of the Seoul branch of a foreign insurer is asked to countersign a 'compliance confirmation' for a five-year IT services agreement worth KRW 9.2 billion with the parent's wholly owned technology subsidiary in Manila. The award was single-source, with no tender and no documented comparison of alternatives. Group internal audit last reviewed the branch 14 months ago and is not scheduled to return for another ten months. The same two staff who handle customer complaints also design and price new products, and they report to the sales head. The local CEO sets the compliance officer's performance rating and bonus, and has asked for the countersignature by Friday, noting that 'head office has already approved the substance'. Separately, the branch's claims function has been run by a local third-party administrator since January without any notification to the FSS, which the CEO calls 'an administrative detail'.
1. Should the compliance officer countersign? Give the basis for refusing or conditioning, and state the escalation route.
Read the worked answer
Do not countersign in the current state. A compliance confirmation is an attestation. Signing it would tell the board and the supervisor that local requirements have been met when they have not.
Deficiencies to record in writing:
- Single-source award of a KRW 9.2 billion, five-year contract with no market testing, due diligence, or comparison against alternatives including a local provider.
- Intra-group pricing: a group subsidiary is not automatically a safe counterparty; arm's-length benchmarking is required.
- No notification to the FSS for material outsourcing, and none for the claims function running since January.
- Segregation failure: product design and pricing sitting with complaint handlers under the sales head.
- Independence failure: the CEO sets the compliance officer's rating and bonus.
Escalation. The officer has a functional line to the group CCO and, locally, a duty to report to the branch management committee or board. Put the refusal in a dated memo, attach the conditions for approval, and escalate in parallel to the group CCO and the local CEO. Where local rules make the outsourcing lapse reportable, notify the FSS. Silent non-signature is not enough; the point is to create a record that protects the branch and the officer.
2. Which regulatory requirements attach to the IT outsourcing and to the undisclosed claims outsourcing, and what must be fixed?
Read the worked answer
IT outsourcing. Even intra-group arrangements must meet the outsourcing standard: documented risk assessment, due diligence, a written contract with service levels, audit and access rights, data-protection and cross-border transfer terms for policyholder data moving to Manila, sub-outsourcing controls, business continuity, and a credible exit plan covering data return, transition assistance and escrow. Concentration on a single group provider is an operational risk that must be assessed and reported. Material outsourcing of core or IT functions triggers supervisory notification, and in some cases prior approval; notice goes before signature.
Claims third-party administrator. Claims handling is a core function that cannot be delegated away: the branch remains liable to policyholders and to the supervisor for timeliness, fairness and complaints. Requirements include an outsourcing agreement with authority limits, service levels, branch quality sampling, complaint routing, data security, audit rights, termination and repatriation of files. Running since January with no notification is itself a compliance breach.
The fix is disclosure plus remediation, not retroactive paperwork presented as routine administration. The compliance officer should not allow the January lapse to be re-characterised once it is known.
3. Set out a 30-day internal-control remediation plan to present to head office, with owners and evidence.
Read the worked answer
- Governance: amend the compliance charter for a functional line to the group CCO, joint objective-setting, removal of the CEO's unilateral rating and bonus power, a documented escalation route to the board, and a compliance veto over new products, outsourcing and material contracts.
- Independence and segregation: move product design and pricing away from the sales head; separate complaint handling from product approval; name a local contact point for internal audit.
- Assurance: bring forward the internal audit cycle; a 14-month gap against a 24-month cycle is not risk-based. Add a targeted audit of intra-group contracts and outsourcing.
- Outsourcing inventory: list every outsourced function, classify core versus non-core, map notification requirements, and complete the missing filings. Give each a named owner and a date.
- Reporting: a monthly compliance pack to the branch board and group CCO covering open issues, ageing, KRIs, regulatory changes and training completion.
- Culture: a protected whistleblowing channel, annual attestations, and manager training on what a compliance sign-off does and does not certify.
Evidence: charter amendments, committee minutes, the inventory, filing acknowledgements, and audit terms of reference. Present the plan as a decision paper requiring board endorsement, not a list of intentions.